SAP June 2024 patch day fixes multiple issues, high severity in Financial Consolidation, NetWeaver
Take action: There are no panic mode patches for this month, but a review is warranted for SAP Financial Consolidation and SAP NetWeaver.
Learn More
On June 2024 Security Patch Day, SAP releaseд ten new and two updated security notes. The updates include patches for various vulnerabilities across multiple SAP products.
High-Priority Security Notes
-
CVE-2024-37177 (CVSS score 8.1) - Cross-Site Scripting (XSS) in Financial Consolidation - This security note addresses two XSS vulnerabilities in SAP’s Financial Consolidation product. The more critical vulnerability allows data to enter a web application from an untrusted source, potentially manipulating website content. This poses significant risks to the confidentiality and integrity of the application.
-
CVE-2024-34688 (CVSS score 7.5) - Denial-of-Service (DoS) in SAP NetWeaver AS Java - This vulnerability impacts the Meta Model Repository services in SAP NetWeaver AS Java. Due to unrestricted access to these services, attackers can cause DoS conditions, rendering the application unusable for legitimate users. DoS conditions preventing legitimate user access.
Other security notes address medium-severity vulnerabilities in the following SAP products:
- CVE-2024-33001, (CVSS score 6.5), Denial of service (DOS) in SAP NetWeaver and ABAP platform
- CVE-2024-34683, (CVSS score 6.5), Unrestricted file upload in SAP Document Builder (HTTP service)
- CVE-2024-34691, (CVSS score 6.5), Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files)
- CVE-2024-34686, (CVSS score 6.1), Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
- CVE-2024-32733, (CVSS score 6.1), Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform
- CVE-2024-37176, (CVSS score 5.5), Missing Authorization check in SAP BW/4HANA Transformation and DTP
- CVE-2024-34690, (CVSS score 5.4), Missing Authorization check in SAP Student Life Cycle Management (SLcM)
- CVE-2024-28164, (CVSS score 5.3), Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures)
- CVE-2024-34684, (CVSS score 3.7), Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Scheduling)
- CVE-2024-33000, (CVSS score 3.5), Missing Authorization check in SAP Bank Account Management
